CVE-2026-75510: Novu In-App Inbox XSS Vulnerability

CVE-2026-75510 Overview

CVE-2026-75510 is a stored cross-site scripting vulnerability in Novu, an open-source notification infrastructure platform. The flaw affects the @novu/js In-App Inbox and the @novu/react Inbox component prior to version 3.18.0. The components accept a call-to-action redirect.url value from the v1 cta.data object without validating its URL scheme. An authenticated organization member or environment API-key holder can store a javascript: redirect in an in-app workflow. When a recipient clicks the notification in a Chromium-based browser, the script executes in the inbox-hosting origin. This vulnerability is tracked under [CWE-79] and is fixed in version 3.18.0.

Critical Impact
Successful exploitation exposes session material and permits authenticated actions in the customer application or the self-hosted Novu dashboard.

Affected Products

Novu @novu/js In-App Inbox prior to 3.18.0
Novu @novu/react Inbox component prior to 3.18.0
Self-hosted Novu dashboard instances using vulnerable inbox components

Discovery Timeline

2026-09-22 - CVE-2026-75510 published to NVD
2026-09-22 - Last updated in NVD database
v3.18.0 - Novu releases patched version with sanitizeInAppRedirect and IN_APP_REDIRECT_URL_REGEX scheme validation

Technical Details for CVE-2026-75510

Vulnerability Analysis

The vulnerability originates in Novu's notification rendering path. The API-side mapper apps/api/src/app/inbox/utils/notification-mapper.ts forwards the redirect.url value from v1 cta.data into the client without scheme validation. The client component packages/js/src/ui/components/Notification/DefaultNotification.tsx then passes this URL to the navigate function defined in packages/js/src/ui/context/InboxContext.tsx. The navigate function invokes window.open with the attacker-supplied URL and a _self target. Chromium-based browsers execute javascript: URIs in this context within the current origin, resulting in script execution inside the inbox-hosting application.

Root Cause

The root cause is missing URL scheme validation on the redirect.url field before it reaches window.open. The previous redirectUrlRegex accepted http://, https://, path-based URLs, and template variables, but the API mapper accepted unvalidated legacy v1 payloads. As a result, javascript: URIs bypassed the intended allow-list and were rendered as clickable notification actions.

Attack Vector

An attacker requires authenticated access as an organization member or possession of a valid environment API key. The attacker submits an in-app workflow containing a call-to-action with redirect.url set to a javascript: payload and target set to _self. When a recipient clicks the notification in a Chromium-based browser, the script executes in the origin hosting the inbox. Attackers can steal session tokens, invoke authenticated API endpoints, or take actions in the self-hosted Novu dashboard on behalf of the victim.

typescript

// Security patch: apps/api/src/app/inbox/utils/notification-mapper.ts
 import type { MessageEntity } from '@novu/dal';
-import { ButtonTypeEnum, MessageActionStatusEnum, SeverityLevelEnum } from '@novu/shared';
+import { ButtonTypeEnum, MessageActionStatusEnum, sanitizeInAppRedirect, SeverityLevelEnum } from '@novu/shared';

 import { InboxNotificationDto, InboxSubscriberResponseDto } from '../dtos/inbox-notification.dto';

// Security patch: libs/application-generic/src/schemas/control/in-app-control.schema.ts
-import { UiComponentEnum, UiSchema, UiSchemaGroupEnum } from '@novu/shared';
+import { IN_APP_REDIRECT_URL_REGEX, UiComponentEnum, UiSchema, UiSchemaGroupEnum } from '@novu/shared';

 const redirectZodSchema = z.object({
-  url: z.string().regex(redirectUrlRegex),
+  url: z.string().regex(IN_APP_REDIRECT_URL_REGEX),
   target: z.enum(['_self', '_blank', '_parent', '_top', '_unfencedTop']),

Source: Novu GitHub Commit f105f3d

Detection Methods for CVE-2026-75510

Indicators of Compromise

In-app workflow definitions containing redirect.url values beginning with javascript:, data:, or other non-HTTP schemes.
API audit log entries showing workflow creation or updates from unexpected organization members or API keys.
Browser console errors or unexpected window.open calls originating from the Novu inbox component.

Detection Strategies

Query the Novu workflow store for any cta.data.redirect.url value that does not match the IN_APP_REDIRECT_URL_REGEX allow-list.
Review web application firewall (WAF) logs for POST requests to Novu workflow APIs containing javascript: payloads in JSON bodies.
Inspect Content Security Policy (CSP) violation reports for inline script executions on origins hosting the Novu inbox.

Monitoring Recommendations

Enable audit logging on the Novu API for all workflow create and update operations, capturing the requesting user and API key identifier.
Monitor for anomalous outbound requests from browsers immediately after users click in-app notifications.
Track version deployment across environments to confirm all instances run 3.18.0 or later.

How to Mitigate CVE-2026-75510

Immediate Actions Required

Upgrade all instances of @novu/js, @novu/react, and self-hosted Novu to version 3.18.0 or later.
Audit existing workflows and remove any redirect.url entries using non-HTTP schemes.
Rotate environment API keys if suspicious workflow modifications are identified in audit logs.

Patch Information

Novu addressed the vulnerability in version 3.18.0. The fix introduces the sanitizeInAppRedirect helper and the IN_APP_REDIRECT_URL_REGEX allow-list, which restrict redirect.url values to http://, https://, or path-based URLs and reject javascript: and other executable schemes. Full details are available in GitHub Security Advisory GHSA-8gr3-5j6f-25gp, Pull Request #11453, and Release v3.18.0.

Workarounds

Restrict organization membership and environment API-key issuance to trusted operators until the patch is deployed.
Deploy a strict Content Security Policy on the inbox-hosting origin that disallows inline script execution and javascript: URIs.
Implement server-side validation in any custom proxy in front of the Novu API to reject workflow payloads containing non-HTTP redirect schemes.

bash

# Upgrade Novu client packages to the patched release
npm install @novu/js@^3.18.0 @novu/react@^3.18.0

# Verify installed versions
npm list @novu/js @novu/react